Improve security of database url

backend/test/azimutt/services/stripe_srv_test.exs

@@ -12,17 +12,18 @@ defmodule Azimutt.Services.StripeSrvTest do
 
     @tag :skip
     test "get_subscriptions" do
-      subscriptions = StripeSrv.get_subscriptions("cus_QLWuSJQsP5COgx")
+      # subscriptions = StripeSrv.get_subscriptions("cus_QLWuSJQsP5COgx")
       # IO.inspect(subscriptions, label: "subscriptions")
     end
 
     @tag :skip
     test "get_price / get_plan" do
-      assert StripeSrv.get_plan(StripeSrv.get_price("solo", "monthly")) == {"solo", "monthly"}
-      assert StripeSrv.get_plan(StripeSrv.get_price("solo", "yearly")) == {"solo", "yearly"}
-      assert StripeSrv.get_plan(StripeSrv.get_price("team", "monthly")) == {"team", "monthly"}
-      assert StripeSrv.get_plan(StripeSrv.get_price("team", "yearly")) == {"team", "yearly"}
-      assert StripeSrv.get_plan(StripeSrv.get_price("pro", "monthly")) == {"pro", "monthly"}
+      assert StripeSrv.get_plan("", StripeSrv.get_price("solo", "monthly")) == {"solo", "monthly"}
+      assert StripeSrv.get_plan("", StripeSrv.get_price("solo", "yearly")) == {"solo", "yearly"}
+      assert StripeSrv.get_plan("", StripeSrv.get_price("team", "monthly")) == {"team", "monthly"}
+      assert StripeSrv.get_plan("", StripeSrv.get_price("team", "yearly")) == {"team", "yearly"}
+      assert StripeSrv.get_plan("", StripeSrv.get_price("pro", "monthly")) == {"pro", "monthly"}
+      assert StripeSrv.get_plan("prod_aaaa", "") == {"enterprise", "yearly"}
     end
   end
 end

cli/src/explore.ts

@@ -1,7 +1,7 @@
 import open from "open";
 import {Logger} from "@azimutt/utils";
 import {DatabaseUrlParsed, parseDatabaseUrl} from "@azimutt/models";
-import {NodeEnv, startServer, track} from "@azimutt/gateway";
+import {buildConfig, NodeEnv, startServer, track} from "@azimutt/gateway";
 import {version} from "./version.js";
 
 export async function launchExplore(url: string, instance: string, logger: Logger): Promise<void> {
@@ -12,13 +12,13 @@ export async function launchExplore(url: string, instance: string, logger: Logge
     // const azimuttUrl = `${instance}/embed?database-source=${encodeURIComponent(url)}&mode=full`
     // https://azimutt.app/embed?database-source=postgresql://postgres:postgres@localhost/azimutt_dev&mode=full
     // const azimuttUrl = `https://azimutt.app/create?database=${encodeURIComponent(url)}&gateway=http://localhost:4177`
-    await startServer({
+    await startServer(buildConfig({
         NODE_ENV: NodeEnv.production,
         LOG_LEVEL: 'info',
         API_HOST: 'localhost',
         API_PORT: '4177',
-        CORS_ALLOW_ORIGIN: '*'
-    })
+        CORS_ALLOW_ORIGIN: '*',
+    }))
     logger.log(`opening ${azimuttUrl}`)
     await open(azimuttUrl)
 }

cli/src/gateway.ts

@@ -1,15 +1,16 @@
 import {Logger} from "@azimutt/utils";
-import {NodeEnv, startServer, track} from "@azimutt/gateway";
+import {buildConfig, NodeEnv, startServer, track} from "@azimutt/gateway";
 import {version} from "./version.js";
 
-export async function launchGateway(logger: Logger): Promise<void> {
+export async function launchGateway(dataSourceUrls: string, logger: Logger): Promise<void> {
     logger.log('Starting Azimutt Gateway...')
     track('cli__gateway__start', {version}, 'cli').then(() => {})
-    await startServer({
+    await startServer(buildConfig({
         NODE_ENV: NodeEnv.production,
         LOG_LEVEL: 'info',
         API_HOST: 'localhost',
         API_PORT: '4177',
-        CORS_ALLOW_ORIGIN: '*'
-    })
+        CORS_ALLOW_ORIGIN: '*',
+        DATASOURCE_URLS: dataSourceUrls,
+    }))
 }

cli/src/index.ts

@@ -31,7 +31,8 @@ program.name('azimutt')
 
 program.command('gateway')
     .description('Launch the gateway server to allow Azimutt to access your local databases.')
-    .action((args) => exec(launchGateway(logger), args))
+    .argument('[datasource_urls]', 'database urls to keep inside the gateway, including credentials')
+    .action((dataSourceUrls, args) => exec(launchGateway(dataSourceUrls, logger), args))
 
 program.command('explore')
     .description('Open Azimutt with your database url to see it immediately.')

frontend/src/Components/Organisms/Details.elm

@@ -24,7 +24,6 @@ import Libs.Html.Attributes exposing (ariaHidden, ariaLabel, css, role)
 import Libs.List as List
 import Libs.Maybe as Maybe
 import Libs.Models.Bytes as Bytes
-import Libs.Models.DatabaseKind as DatabaseKind
 import Libs.Models.HtmlId exposing (HtmlId)
 import Libs.Models.Notes exposing (Notes)
 import Libs.Models.Tag as Tag exposing (Tag)
@@ -816,37 +815,40 @@ viewSource openDataExplorer table column rows origin =
             SourceKind.DatabaseConnection _ ->
                 Icon.solid Icons.sources.database "opacity-50 mr-1" |> Tooltip.r "Database source"
 
-            SourceKind.SqlLocalFile _ _ _ ->
+            SourceKind.SqlLocalFile _ ->
                 Icon.solid Icons.sources.sql "opacity-50 mr-1" |> Tooltip.r "SQL source"
 
-            SourceKind.SqlRemoteFile _ _ ->
+            SourceKind.SqlRemoteFile _ ->
                 Icon.solid Icons.sources.sql "opacity-50 mr-1" |> Tooltip.r "SQL source"
 
-            SourceKind.PrismaLocalFile _ _ _ ->
+            SourceKind.PrismaLocalFile _ ->
                 Icon.solid Icons.sources.prisma "opacity-50 mr-1" |> Tooltip.r "Prisma source"
 
-            SourceKind.PrismaRemoteFile _ _ ->
+            SourceKind.PrismaRemoteFile _ ->
                 Icon.solid Icons.sources.prisma "opacity-50 mr-1" |> Tooltip.r "Prisma source"
 
-            SourceKind.JsonLocalFile _ _ _ ->
+            SourceKind.JsonLocalFile _ ->
                 Icon.solid Icons.sources.json "opacity-50 mr-1" |> Tooltip.r "JSON source"
 
-            SourceKind.JsonRemoteFile _ _ ->
+            SourceKind.JsonRemoteFile _ ->
                 Icon.solid Icons.sources.json "opacity-50 mr-1" |> Tooltip.r "JSON source"
 
             SourceKind.AmlEditor ->
                 Icon.solid Icons.sources.aml "opacity-50 mr-1" |> Tooltip.r "AML source"
         , text (origin.name ++ (rows |> Maybe.mapOrElse (\r -> " (" ++ String.fromInt r ++ " rows)") ""))
-        , origin.db
-            |> Maybe.andThen DatabaseKind.fromUrl
-            |> Maybe.map (\kind -> column |> Maybe.mapOrElse (DbQuery.exploreColumn kind table) (DbQuery.exploreTable kind table))
-            |> Maybe.map
-                (\query ->
-                    button [ type_ "button", onClick (openDataExplorer origin.id query), class "ml-1" ]
-                        [ Icon.solid Icon.ArrowCircleRight "opacity-50" ]
-                        |> Tooltip.r "Browse data"
-                )
-            |> Maybe.withDefault (text "")
+        , case origin.kind of
+            SourceKind.DatabaseConnection db ->
+                let
+                    query : SqlQueryOrigin
+                    query =
+                        column |> Maybe.mapOrElse (DbQuery.exploreColumn db.kind table) (DbQuery.exploreTable db.kind table)
+                in
+                button [ type_ "button", onClick (openDataExplorer origin.id query), class "ml-1", ariaLabel "Browse data" ]
+                    [ Icon.solid Icon.ArrowCircleRight "opacity-50" ]
+                    |> Tooltip.r "Browse data"
+
+            _ ->
+                text ""
         ]
 
 

frontend/src/Components/Organisms/TableRow.elm

@@ -24,7 +24,7 @@ import Libs.Html.Attributes exposing (ariaExpanded, ariaHaspopup, css)
 import Libs.Html.Events exposing (PointerEvent, onContextMenu, onDblClick, onPointerUp)
 import Libs.List as List
 import Libs.Maybe as Maybe
-import Libs.Models.DatabaseKind as DatabaseKind
+import Libs.Models.DatabaseKind as DatabaseKind exposing (DatabaseKind(..))
 import Libs.Models.DateTime as DateTime
 import Libs.Models.HtmlId exposing (HtmlId)
 import Libs.Models.Notes exposing (Notes)
@@ -45,6 +45,7 @@ import Models.Project.ColumnName exposing (ColumnName)
 import Models.Project.ColumnPath as ColumnPath exposing (ColumnPath, ColumnPathStr)
 import Models.Project.ColumnRef exposing (ColumnRef)
 import Models.Project.ColumnType exposing (ColumnType)
+import Models.Project.DatabaseUrlStorage as DatabaseUrlStorage
 import Models.Project.Relation as Relation exposing (Relation)
 import Models.Project.RowPrimaryKey as RowPrimaryKey exposing (RowPrimaryKey)
 import Models.Project.RowValue exposing (RowValue)
@@ -985,7 +986,7 @@ docSource : Source
 docSource =
     { id = SourceId.one
     , name = "azimutt_dev"
-    , kind = DatabaseConnection "postgresql://postgres:postgres@localhost:5432/azimutt_dev"
+    , kind = DatabaseConnection { kind = PostgreSQL, url = Just "postgresql://postgres:postgres@localhost:5432/azimutt_dev", storage = DatabaseUrlStorage.Project }
     , content = Array.empty
     , tables =
         [ docTable "public" "users" [ ( "id", "uuid", False ), ( "slug", "varchar", False ), ( "name", "varchar", False ), ( "email", "varchar", False ), ( "provider", "varchar", True ), ( "provider_uid", "varchar", True ), ( "avatar", "varchar", False ), ( "github_username", "varchar", True ), ( "twitter_username", "varchar", True ), ( "is_admin", "boolean", False ), ( "hashed_password", "varchar", True ), ( "last_signin", "timestamp", False ), ( "created_at", "timestamp", False ), ( "updated_at", "timestamp", False ), ( "confirmed_at", "timestamp", True ), ( "deleted_at", "timestamp", True ), ( "data", "json", False ), ( "onboarding", "json", False ), ( "provider_data", "json", True ), ( "tags", "varchar[]", False ) ]